# CVEs published 2016-04-20

10 CVEs were published on April 20, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-0891](https://cve.now/CVE-2016-0891.md): Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hija (no CVSS)
- [CVE-2016-1384](https://cve.now/CVE-2016-1384.md): The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted (no CVSS)
- [CVE-2016-2002](https://cve.now/CVE-2016-2002.md): The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x b (no CVSS)
- [CVE-2016-2003](https://cve.now/CVE-2016-2003.md): HPE P9000 Command View Advanced Edition Software (CVAE) 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote at (no CVSS)
- [CVE-2016-2202](https://cve.now/CVE-2016-2202.md): The Inventory Solution component in the Management Agent in the client in Symantec Altiris IT Management Suite (ITMS) through 7.6 HF7 allows (no CVSS)
- [CVE-2014-9770](https://cve.now/CVE-2014-9770.md): tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal (no CVSS)
- [CVE-2015-7801](https://cve.now/CVE-2015-7801.md): Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file. (no CVSS)
- [CVE-2015-7802](https://cve.now/CVE-2015-7802.md): gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via (no CVSS)
- [CVE-2015-8842](https://cve.now/CVE-2015-8842.md): tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obta (no CVSS)
- [CVE-2016-3628](https://cve.now/CVE-2016-3628.md): Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance before 2.4.0 allows remote (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.